2dbf9bbb854f40d4deb45cf83c95e38597fbce951f86be9e2ad22a75951f9a29

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 04:49

Target

24ae59d8f93571f7305d819d800b9c7c_JaffaCakes118.dll
Size

265KB
MD5

24ae59d8f93571f7305d819d800b9c7c
SHA1

76b5065aca025b5fd24aee2f70432bbf8c751370
SHA256

2dbf9bbb854f40d4deb45cf83c95e38597fbce951f86be9e2ad22a75951f9a29
SHA512

1e3b39a377e04d1ee323d7d13eb367a4f882dd92312d1c862aaee6d7af362a324525a95a4990508c8c096fcbc50aa4791e487f1183f1c8932a99dfa9e0e9ea5f
SSDEEP

6144:rszrIP3acuC5Cydti9Pet80gUTpVNBMVM4l4SzPiYK:4zcPTuCYZ9zDUpVNBMVM4piYK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2052	1780	rundll32.exe	28
PID 1780 wrote to memory of 2052	1780	rundll32.exe	28
PID 1780 wrote to memory of 2052	1780	rundll32.exe	28
PID 1780 wrote to memory of 2052	1780	rundll32.exe	28
PID 1780 wrote to memory of 2052	1780	rundll32.exe	28
PID 1780 wrote to memory of 2052	1780	rundll32.exe	28
PID 1780 wrote to memory of 2052	1780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24ae59d8f93571f7305d819d800b9c7c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24ae59d8f93571f7305d819d800b9c7c_JaffaCakes118.dll,#1
  2⤵
  PID:2052

memory/2052-0-0x0000000010002000-0x0000000010004000-memory.dmp

Filesize
8KB

Download